CVE-2026-40156: PraisonAI RCE Vulnerability

CVE-2026-40156 Overview

CVE-2026-40156 is a Code Injection vulnerability affecting PraisonAI, a multi-agent teams system. Prior to version 4.5.128, PraisonAI automatically loads and executes a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_location and immediately executes module-level code via spec.loader.exec_module() without explicit user consent, validation, or sandboxing.

The tools.py file is loaded implicitly, even when it is not referenced in configuration files or explicitly requested by the user. As a result, merely placing a file named tools.py in the working directory is sufficient to trigger arbitrary code execution. This behavior violates the expected security boundary between user-controlled project files (e.g., YAML configurations) and executable code, as untrusted content in the working directory is treated as trusted and executed automatically.

Critical Impact
If an attacker can place a malicious tools.py file into a directory where a user or automated system (e.g., CI/CD pipeline) runs praisonai, arbitrary code execution occurs immediately upon startup, before any agent logic begins.

Affected Products

PraisonAI versions prior to 4.5.128

Discovery Timeline

April 10, 2026 - CVE-2026-40156 published to NVD
April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40156

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The core issue lies in PraisonAI's automatic tool discovery mechanism, which unconditionally loads and executes Python code from the working directory without user acknowledgment or security controls.

The attack requires local access and user interaction (such as a user navigating to a directory containing a malicious tools.py file and running the praisonai command). This makes the vulnerability particularly dangerous in shared development environments, cloned repositories with malicious contributions, or CI/CD pipelines that process untrusted code.

The vulnerability enables complete compromise of the system running PraisonAI, allowing attackers to steal credentials, exfiltrate data, install backdoors, or pivot to other systems on the network.

Root Cause

The root cause is the implicit trust placed in files within the current working directory. PraisonAI uses Python's importlib module to dynamically load tools.py without performing any validation checks on the file's origin, integrity, or contents. The module-level code executes during the import process itself, meaning malicious payloads run before the application can apply any security controls or user prompts.

This design pattern conflates data files (configuration YAML) with executable code, violating the principle of least privilege and the security boundary that users expect between configuration and code execution.

Attack Vector

The attack vector requires local access to place a malicious tools.py file in a target directory. Exploitation scenarios include:

Social Engineering: Convincing a user to download and extract an archive containing a malicious tools.py file
Supply Chain Attacks: Submitting malicious pull requests to repositories that include a tools.py file
CI/CD Pipeline Compromise: Placing malicious files in repositories processed by automated build systems running PraisonAI
Shared Development Environments: Dropping malicious files in shared network directories used by multiple developers

When a user executes praisonai in a directory containing the malicious file, the attacker's code runs with the full privileges of the executing user. The malicious payload can perform any operation the user is authorized to perform, including accessing sensitive data, modifying system configurations, or establishing persistent access.

Detection Methods for CVE-2026-40156

Indicators of Compromise

Unexpected tools.py files appearing in project directories that were not created by authorized users
Unusual process spawning or network connections initiated immediately after praisonai startup
Modified or newly created files in sensitive directories following PraisonAI execution
Anomalous outbound connections from systems running PraisonAI to unknown external hosts

Detection Strategies

Monitor file system activity for creation of tools.py files in directories associated with PraisonAI projects
Implement file integrity monitoring (FIM) on development directories and CI/CD build environments
Review process execution logs for unexpected child processes spawned by praisonai or Python interpreters
Deploy endpoint detection and response (EDR) solutions to identify code injection attempts during module loading

Monitoring Recommendations

Enable audit logging on systems running PraisonAI to track file access and process creation events
Configure alerting for any tools.py file creation or modification in monitored directories
Implement network monitoring to detect unusual outbound connections from development systems
Review CI/CD pipeline logs for unexpected code execution patterns during PraisonAI operations

How to Mitigate CVE-2026-40156

Immediate Actions Required

Upgrade PraisonAI to version 4.5.128 or later immediately
Audit all directories where PraisonAI is executed for unexpected tools.py files
Review recent changes to repositories and project directories for unauthorized file additions
Inspect CI/CD pipeline configurations to ensure untrusted code cannot place files in execution directories

Patch Information

This vulnerability is fixed in PraisonAI version 4.5.128. Users should upgrade to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory.

Workarounds

Verify the working directory does not contain unexpected tools.py files before running praisonai
Run PraisonAI in isolated environments (containers, VMs) with restricted file system access
Implement directory access controls to prevent unauthorized file creation in PraisonAI project directories
Use read-only file systems or volume mounts where feasible to prevent malicious file placement

bash

# Verify no unexpected tools.py exists before execution
if [ -f "tools.py" ]; then
    echo "WARNING: tools.py found in current directory. Verify this file is trusted before proceeding."
    exit 1
fi
praisonai